There are certain aviation events that feel almost implausible when you first hear them, not because they involve dramatic explosions or catastrophic structural failures, but precisely because they unfold so quietly and progressively that, at each individual step, nothing appears obviously wrong.
This is one of those cases.
An Airbus A330, a modern long-haul aircraft designed with multiple layers of redundancy and advanced automation, found itself gliding silently over the Atlantic Ocean after losing both engines—not due to a sudden failure, but because, over time, it simply ran out of fuel.
It began, as many of these situations do, with something subtle
On 24 August 2001, Air Transat Flight 236 was cruising normally between Toronto and Lisbon when the crew observed a fuel imbalance indication, with the right tank showing less fuel than expected relative to the left.
At this stage, there was no emergency, no clear failure, and no indication of an external leak—only a discrepancy that required interpretation.
From a systems perspective, this is already where things become interesting, because the aircraft was not presenting a failure state, but rather a condition that could plausibly be explained in multiple ways.
The response was entirely logical
The crew followed established procedures to manage the imbalance, including opening the crossfeed valve in an attempt to equalise fuel distribution between the tanks.
This is standard practice and, under normal circumstances, exactly the correct response.
However, embedded within that decision was an assumption, subtle but critical, that the issue lay in distribution or measurement rather than in an active loss of fuel from the system.
The system was behaving correctly, but incompletely
What was actually occurring in the background was far less benign.
A fuel line had been improperly installed during maintenance, which resulted in it contacting and chafing against a hydraulic line, eventually creating a leak that allowed fuel to escape from the aircraft.
The leak was not rapid or dramatic; instead, it progressed steadily, without any single indication that would clearly identify it as such.
The aircraft’s systems continued to provide data—imbalances, consumption rates—but they did not synthesise that data into a clear narrative, leaving the crew to interpret what they were seeing based on the information available to them.
And this is where the situation begins to shift
From the cockpit, the indications remained consistent with a manageable imbalance issue, and the actions taken were aligned with both training and procedure.
Yet, by opening the crossfeed, fuel from the unaffected tank was now being routed toward the side of the leak, effectively increasing the rate at which usable fuel was being lost from the aircraft.
At no point did this feel like an obviously incorrect action, because it fit within a coherent and reasonable understanding of the situation as it was perceived.
The critical point is not that the crew made a mistake
Rather, it is that the system, taken as a whole, created a scenario in which a well-trained crew, following appropriate procedures, could arrive at a conclusion that was both logical and incorrect at the same time.
This is a far more uncomfortable type of failure than a simple technical fault, because it emerges not from a breakdown of components, but from a mismatch between reality and the model used to interpret it.
From there, the situation becomes unavoidable
As fuel continued to be lost, the first engine eventually flamed out, followed by the second, removing any remaining ambiguity about the severity of the situation.
At that point, the aircraft transitioned from a powered flight regime into a glide, with limited electrical power and a rapidly shrinking set of available options.
The crew diverted toward Lajes Air Base in the Azores, managing the aircraft’s energy state with precision and ultimately achieving a successful, though hard, landing.
All 306 people on board survived.
What makes this case worth revisiting
It would be easy to attribute this event solely to a maintenance error, and while that is certainly a contributing factor, doing so misses the more interesting and instructive aspect of the case.
The aircraft did not simply fail; instead, it provided a set of indications that supported a believable but incorrect interpretation of what was happening.
In that space—between normal operation and clear failure—decisions are made not under conditions of uncertainty alone, but under conditions of plausible certainty, where the available information supports a coherent narrative that happens to be wrong.
Final thought
Air Transat 236 did not run out of fuel because the problem went unnoticed, but because it was understood in a way that made sense at the time.
And in complex systems, that is often where the most challenging failures reside—not in what is hidden, but in what appears, convincingly, to be understood.
Related Posts
